Project

General

Profile

Actions
Copy link

Feature #97305

closed

Introduce CSRF handling for forms

Added by Oliver Hader over 2 years ago. Updated 10 months ago.

Status:
Closed
Priority:
Should have
Assignee:
Oliver Hader
Category:
Security
Target version:
Candidate for Major Version
Start date:
2022-11-30
Due date:
% Done:

100%

Estimated time:
(Total: 0.00 h)
PHP Version:
Tags:
Complexity:
Sprint Focus:

Description

see https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#login-csrf

Future topics after PS25 (https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183/25) in separate patch:

  • maybe reuse Nonce cookie?
  • AbstractUserAuth event handling tokens
  • Extbase generic handling
  • RequestToken->consumed property

Subtasks 1 (0 open — 1 closed)

Feature #99232: Add event to intercept/adjust request-tokenClosedOliver Hader2022-11-30

Actions

Related issues 3 (0 open — 3 closed)

Related to TYPO3 Core - Task #98473: Extend RequestToken testsClosedOliver Hader2022-09-29

Actions
Related to TYPO3 Core - Task #98508: Use pepper explicitly for creating signing keysClosedOliver Hader2022-10-03

Actions
Related to TYPO3 Core - Bug #101209: Backend refresh login cannot re-authenticateClosed2023-06-30

Actions
Actions
Copy link
 #1

Updated by Gerrit Code Review over 2 years ago

  • Status changed from New to Under Review

Patch set 1 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #2

Updated by Gerrit Code Review over 2 years ago

Patch set 2 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #3

Updated by Gerrit Code Review over 2 years ago

Patch set 3 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #4

Updated by Gerrit Code Review over 2 years ago

Patch set 4 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #5

Updated by Gerrit Code Review over 2 years ago

Patch set 5 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #6

Updated by Gerrit Code Review about 2 years ago

Patch set 6 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #7

Updated by Gerrit Code Review about 2 years ago

Patch set 7 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #8

Updated by Gerrit Code Review about 2 years ago

Patch set 8 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #9

Updated by Gerrit Code Review about 2 years ago

Patch set 9 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #12

Updated by Gerrit Code Review about 2 years ago

Patch set 10 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #13

Updated by Gerrit Code Review about 2 years ago

Patch set 11 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #14

Updated by Gerrit Code Review about 2 years ago

Patch set 12 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #15

Updated by Gerrit Code Review about 2 years ago

Patch set 13 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #16

Updated by Gerrit Code Review about 2 years ago

Patch set 14 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #17

Updated by Gerrit Code Review about 2 years ago

Patch set 15 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #18

Updated by Gerrit Code Review about 2 years ago

Patch set 16 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #19

Updated by Gerrit Code Review about 2 years ago

Patch set 17 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #20

Updated by Gerrit Code Review about 2 years ago

Patch set 18 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #21

Updated by Gerrit Code Review about 2 years ago

Patch set 19 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #22

Updated by Gerrit Code Review about 2 years ago

Patch set 20 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #23

Updated by Gerrit Code Review about 2 years ago

Patch set 21 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #24

Updated by Gerrit Code Review about 2 years ago

Patch set 22 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #25

Updated by Gerrit Code Review about 2 years ago

Patch set 23 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #26

Updated by Gerrit Code Review about 2 years ago

Patch set 24 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #27

Updated by Gerrit Code Review about 2 years ago

Patch set 25 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #28

Updated by Oliver Hader about 2 years ago

  • Description updated (diff)
Actions
Copy link
 #29

Updated by Gerrit Code Review about 2 years ago

Patch set 26 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #30

Updated by Gerrit Code Review about 2 years ago

Patch set 27 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #31

Updated by Gerrit Code Review about 2 years ago

Patch set 28 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #32

Updated by Gerrit Code Review about 2 years ago

Patch set 29 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #33

Updated by Gerrit Code Review about 2 years ago

Patch set 30 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #34

Updated by Gerrit Code Review about 2 years ago

Patch set 31 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #35

Updated by Gerrit Code Review about 2 years ago

Patch set 32 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #36

Updated by Gerrit Code Review about 2 years ago

Patch set 33 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions
Copy link
 #37

Updated by Oliver Hader about 2 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
Actions
Copy link
 #38

Updated by Oliver Hader about 2 years ago

  • Related to Task #98473: Extend RequestToken tests added
Actions
Copy link
 #39

Updated by Oliver Hader about 2 years ago

  • Related to Task #98508: Use pepper explicitly for creating signing keys added
Actions
Copy link
 #40

Updated by Benni Mack about 2 years ago

  • Status changed from Resolved to Closed
Actions
Copy link
 #41

Updated by Gerrit Code Review about 2 years ago

  • Status changed from Closed to Under Review

Patch set 1 for branch 11.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/76357

Actions
Copy link
 #42

Updated by Gerrit Code Review about 2 years ago

Patch set 2 for branch 11.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/76357

Actions
Copy link
 #43

Updated by Gerrit Code Review about 2 years ago

Patch set 3 for branch 11.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/76357

Actions
Copy link
 #44

Updated by Gerrit Code Review almost 2 years ago

Patch set 4 for branch 11.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/76357

Actions
Copy link
 #45

Updated by Oliver Hader almost 2 years ago

  • Subtask #99232 added
Actions
Copy link
 #46

Updated by Benni Mack over 1 year ago

  • Target version changed from 12 LTS to Candidate for Major Version
Actions
Copy link
 #47

Updated by Oliver Hader over 1 year ago

  • Status changed from Under Review to Resolved

Done for TYPO3 v12. Nobody was interested in testing the back-port I created to TYPO3 v11.

Actions
Copy link
 #48

Updated by Oliver Hader over 1 year ago

  • Related to Bug #101209: Backend refresh login cannot re-authenticate added
Actions
Copy link
 #49

Updated by Benni Mack 10 months ago

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: Atom PDF